Share QuickBooks Access Safely (Roles, Accountant User, MFA)

Why QuickBooks deserves extra care

QuickBooks controls invoices, bank feeds, payroll, and tax data. A leaked login can move money and expose PII. Skip shared passwords—use invites, roles, and MFA with a simple handoff routine.

The safest way to add your accountant

1. Use the dedicated Accountant access (not your main login). It gives the right permissions without sharing ownership.
2. Require MFA on all user accounts. If anyone needs a memorable master, share this primer: How to Create Strong Passphrases You’ll Actually Remember.
3. Verify the invite on a quick call before they click. Habit guide: Stop Phishing at the Source: Verify Links Like a Pro.

Roles & least privilege

• Accountant: full accounting tools; use for your CPA/firm.
• Standard/Custom roles: create narrow access for staff or agencies (e.g., Sales only, Expenses only).
• Admin: restrict to the owner/IT—rarely needed by vendors.

Don’t email CSVs or PDFs full of PII

• If you must export, deliver via a one-time, expiring link and send the access code in a separate channel. Basics: The Safe Way to Share Passwords in 2025 (No Email).
• Strip metadata & watermark sensitive PDFs. How-to: Redact Sensitive Info in Screenshots and PDFs.

Offboarding & audits

• Remove users when projects end and rotate any shared credentials they touched. Checklist: Employee Offboarding: Revoke, Rotate, and Re-Share.
• Sweep old threads for exposures (passwords, bank details) and clean up: Audit Your Old Messages (90-Minute Sweep).
• Payment changes? Verify by phone before sending money. Playbook: Send Banking Details Safely.

Useful external references

• QuickBooks Online: Roles & permissions 🔗
• QuickBooks: Set up 2-Step Verification 🔗

Related reading

Onboard agencies the safe way: Secure Client Onboarding (Checklist)

Respond fast after a slip-up: The Simple Incident Playbook for Leaked Passwords

Bottom line

Add people via roles and Accountant access, enforce MFA, deliver exports ephemerally, and remove access when the work ends.

Secure One-Time Messages - Send confidential messages that self-destruct after being read once. Your privacy is our priority. →.